Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 22:41
Static task
static1
Behavioral task
behavioral1
Sample
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe
Resource
win10v2004-20220812-en
General
-
Target
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe
-
Size
84KB
-
MD5
40b1a103f8b7ef3a395a7ba860cab16d
-
SHA1
c56493a2938b35b44f9b0ba0bada7ba56b87b4d9
-
SHA256
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674
-
SHA512
99475a4779a310a10cf993606906a322bdb71377e37977e32e3bba91f44b34b11045a46b218f5611dbf51829be20de1d734474696c2ad94bc7d8c58e2a95d438
-
SSDEEP
1536:kpgpHzb9dZVX9fHMvG0D3XJwIKGA61MVt5Rf26G93E6NO1uWFlkqIzjbanys:SgXdZt9P6D3XJwIKQCjROlhOZFl5K2
Malware Config
Signatures
-
Loads dropped DLL 27 IoCs
Processes:
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exepid process 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe 900 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exedescription ioc process File opened for modification \??\PhysicalDrive0 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe -
Drops file in Program Files directory 1 IoCs
Processes:
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exedescription ioc process File created C:\Program Files (x86)\greedou\reply.htm 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
Processes:
3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.p100.pw" 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.p100.pw" 3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe"C:\Users\Admin\AppData\Local\Temp\3ee9ec2260b8b4e647aa044a5001b316e4f298606fdcb3590a8f0ec94f61f674.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\Inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\Md5dll.dllFilesize
8KB
MD5a7d710e78711d5ab90e4792763241754
SHA1f31cecd926c5d497aba163a17b75975ec34beb13
SHA2569b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
SHA512f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
\Users\Admin\AppData\Local\Temp\nsoAFB.tmp\xID.dllFilesize
3KB
MD576d2faad042161f24b6c9c78de3bd265
SHA112518e1ba9e96dc202e6c12267650e52f1058664
SHA2560b31ee64cab09f19e672b3d7f7d11516fe1cd373c2e2861a955b84d054c0507f
SHA512cea11e232eabf2d525b09cae03e8f8a0b83f92a718f8cf92308d7f31bd4f92ab96c34c1107dbed14517f17ee41a84afd3433f42148edebfbaeca78a517b7e508
-
memory/900-54-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB